Eight Years Inside the Walls.
The FBI Finally Pulls the Plug on China's QTFY Machine
Every spy novelist dreams up the long con: the asset who sits quietly inside the target for years, reading everything, saying nothing. This week the Justice Department admitted that's exactly what happened to the United States. Not one agency. A whole list of them, over roughly eight years, and nobody noticed until the pattern got too big to ignore.
According to CyberScoop, federal officials revealed a state-sponsored Chinese operation called QTFY, which they say has been probing American critical infrastructure since 2018. An unsealed affidavit ties it to a Chinese government-funded front company, Nanjing Xinjiuwei Network Technology Company, and says the group went after the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, and the National Institutes of Health. A March attempt on the Senate failed. So did a June attempt on a US election system. The FBI seized three domains, cutting off QScan and QTRouter, the group's two main platforms. QScan alone carried more than 200 exploits and, on one day in 2024, ran over two million scanning and exploit tasks.
"State-sponsored malicious hackers preying on America's critical infrastructure will be stopped and prosecuted."
— Attorney General Todd Blanche, via CyberScoop, October 2026Notice the architecture. This wasn't a lone crew with a clever trick. It was a front company, a botnet, a scanning platform, and a library of ready-made exploits, built like a supply chain. That's how a modern service runs an industrial espionage program: the state supplies the targets, a commercial shell supplies the deniability, and the tooling does the grinding. In September 2024 the group reportedly used several Ivanti zero-days to get into three Energy Department national labs, NIH, and a security-device maker. Think about what that means. Someone was shopping the same network edge devices that defenders trust to keep them safe.
For the real intelligence world, the takedown is the easy half. Seizing domains hurts, but it doesn't erase eight years of collection, and it doesn't tell you what was taken or who has already read it. The FBI, NSA, and Cyber National Mission Force put out a joint advisory with indicators of compromise, and Lumen's Black Lotus Labs helped with the disruption. Expect counterintelligence teams to spend the next year working backward: which stolen files fed which negotiating position, which research program, which defense contract. A hack is only the opening move. The payoff comes when the other side uses what it learned.
Key Takeaways
- US officials say the QTFY operation compromised or targeted federal networks since 2018, including Energy, Justice, HHS, the Federal Reserve, NASA, and NIH.
- The FBI seized three domains tied to the QScan and QTRouter platforms, and an affidavit links the group to a Chinese government-funded front company.
- Edge-device zero-days, such as the Ivanti flaws used in 2024, remain a favorite way in for state hackers because defenders trust those devices.
- A takedown ends the infrastructure, not the damage: the real work now is working out what was stolen and how it is being used.
The Blake MacKay Connection
Blake MacKay learned early that the worst breach is the one you never see, a quiet presence inside the walls that has already read your plans. QTFY is that lesson written in code and sustained for eight years. Start the series free with Intercept and watch Blake hunt the threat that's already in the room.
Read the Full Article at CyberScoop → ← Back to Intel Briefing